We use SASL authentication in combination with postfix' smtpd_sender_login_maps to restrict the FROM addresses an authenticated SMTP user is allowed to use.
By default the users are only allowed to use their own mail address including all aliases. We implemented this behaviour with a mysql map.
Some users are allowed to use other mail addresses. This can be configured in the admin UI under "Mailbox permissions" / "Send as". This configuration, however, is only stored in a file instead of the database. Therefore we are currently not able to use this information in the smtpd_sender_login_maps.